[DO NOT MERGE] 0.23.1 + StackRox patches

[Stringy]

Primary new fixes in this update:

BPF verifier fixes (4 files)

• syscall_exit.bpf.c: Refactored sys_exit and sampling_logic_exit() to do a single maps__get_capture_settings() lookup instead of three separate inlined map lookups (maps__get_dropping_mode(), maps__get_sampling_ratio(), maps__get_drop_failed()). Clang was optimizing away null checks on
  repeated lookups of the same map, causing R0 invalid mem access 'map_value_or_null' on kernels < 6.17.
• toctou_mitigation.h: Same pattern — toctou_mitigation__sampling_logic_enter() now does a single maps__get_capture_settings() lookup and accesses settings->dropping_mode / settings->sampling_ratio directly.
• extract_from_kernel.h: Replaced READ_TASK_FIELD_INTO with BPF_CORE_READ_INTO for all task->cred reads (5 call sites). Fixes BPF verifier rejection on COS (clang-compiled kernel with RCU pointer annotations on credential structs).
• execve.bpf.c / execveat.bpf.c: Wrapped t1_execve_x, t2_execve_x, t1_execveat_x, t2_execveat_x bodies in #if 0. These tail-call programs are unreachable (execve's main program returns early for both success and failure) or unused (collector doesn't subscribe to execveat). Stubbing them
  frees instruction budget, making the volatile fix on push__bytebuf safe without exceeding the 1M instruction limit.

TOCTOU program disable (1 file)

• lifecycle.c: Added a loop before the existing ia32 TOCTOU disable logic that checks whether each 64-bit TOCTOU mitigation program's syscall tracepoint exists on the running kernel. Checks /sys/kernel/tracing/events/syscalls/sys_enter_ with debugfs fallback. If the tracepoint
  doesn't exist (e.g., openat2 on kernels < 5.6), disables autoloading to prevent CO-RE relocation failures for missing BTF types like struct open_how.

Exepath resolution (1 file)

• parsers.cpp: Added fallback in parse_execve_exit for when enter events are unavailable (modern BPF marks them EF_OLD_VERSION). Uses Parameter 31 (bprm->filename) from the exit event. Filters out fd-based execs (/dev/fd/N, /proc/self/fd/N) which are intermediate container runtime steps
  (fexecve) — without this filter, phantom process signals appear with wrong name/path. Also fixed m_len → len() accessor in parse_pidfd_getfd_exit.

Build fix (1 file)

• CMakeLists.txt: Fixed CMake dependency cycle by compiling event_table.c, flags_table.c, dynamic_params_table.c directly into the events_dimensions_generator executable instead of linking scap_event_schema. CMake 3.31+ (used by the collector builder) enforces cycle detection that
  upstream's CI (CMake 3.22) doesn't hit.

Assert macro fix (1 file)

• sinsp_public.h: Replaced libsinsp_logger()->format() in ASSERT_TO_LOG with falcosecurity_log_fn callback from scap_log.h. Avoids circular include dependency (logger.h → sinsp_public.h). Falls back to assert() if the callback isn't set.